created: 2025-07-21 17:12 tags: - ESC10 - ADCS-ESC10 aliases: - ESC10 Type: updated: 2025-07-21 17:12
06 ‐ Privilege Escalation · ly4k/Certipy Wiki · GitHub
reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /v CertificateMappingMethods
CertificateMappingMethods 的 REG_DWORD 标志位是0x4
CertificateMappingMethods
REG_DWORD
可以控制一个对象的UPN字段
【week10】Mirage > 3.1. 10.ESC10 ESC10